DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[BFX]

DSO-X3014T arrived yesterday. Today "upgrade" done    Thank you so much Steve
Next task HW mod

[hv222]

Did someone have a full front-and schematic?

[NorcalNerd]

Hello again, and thanks for your help.

Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.

1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?

From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I  think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".

"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.

Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :

"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:

2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?

Thank you kindly for verifying this and your help, best to all in 2019!

NorcalNerd

[NorcalNerd]

If anyone who knows can please clarify -- thank you,

NN

[Gandalf_Sr]

Picked up an MSOX4054A today on eBay with the DSOX4APPBNDL (BDL) included which is supposed to enable all of the InfiniiVision 4000 X-Series software applications listed below.

DSOX4AERO A/D trigger and decode (MIL-STD 1553/ARINC 429)
DSOX4AUDIO Audio serial trigger and analysis (I²S)
DSOX4AUTO Automotive trigger and analysis (CAN/LIN/CANdbc)
DSOX4COMP Computer trigger and analysis (RS232/UART)
DSOX4EMBD Embedded trigger and analysis (I²C/SPI)
DSOX4FLEX FlexRay trigger and analysis
DSOX4NRZ User-definable Manchester/NRZ trigger and analysis
DSOX4CXPI CXPI trigger and analysis
DSOX4MASK Mask limit testing
DSOX4PWR Power measurements
DSOX4FRA Frequency Response Analysis (FRA)
DSOX4SENSOR SENT serial trigger and analysis
DSOX4USBFL Low and full-speed USB 2.0 trigger and analysis
DSOX4USBH Hi-speed USB 2.0 trigger and analysis (1 GHz and 1.5 GHz models only)
DSOX4USBSQ USB 2.0 signal quality test
DSOX4VID Video trigger and analysis
DSOX4WAVEGEN2 Integrated 20 MHz dual-channel function/arbitrary waveform generator
DSOX4NFC NFC trigger and automated test software
DSOX4UPD USB Power Delivery (USB PD) trigger and analysis

Other than a bandwidth upgrade from 500 MHz (which I think needs to be done by Keysight (PCB change), is anything missing from the list above that is an option for this scope?

I have an MSO7104B that I'll be selling

[TheSteve]

MSO cable could be handy if you don't have a compatible one. An upgrade beyond 500 MHz does require a hardware change. Most of your probes should be compatible.

[Keysight DanielBogdanoff]

Congrats @Gandalf_Sr

The App Bundle license turns on all the things you'd ever need. There are a couple discovered by this form somewhere(like RML), but there's no real use for those other than for our developers/debugging.

[Gandalf_Sr]

Thanks guys.  I already have an MSO cable set with grabbers.

[maxpayne]

Congrats @Gandalf_Sr

The App Bundle license turns on all the things you'd ever need. There are a couple discovered by this form somewhere(like RML), but there's no real use for those other than for our developers/debugging.

As an oscilloscope owner, can the buyer get free license for Benchvue software all modules ?

[titiris]

Hi!
I'm new here, and still excited reading and reading and doing more. Thanks to all for sharing.
I bought a bricked DSOX2014    and after 4 nights reading hundreds (no cheating!) of posts, without any previous WinCE knowledge, I learned:
- what is U-Boot
- what is the nk.bin
- where to connect the serial port
- how the v2.35 runs from an USB drive

and I was able to recover the scope WITHOUT network connection, in one hour, without any failure or drawback, at the first try. 
I will write the procedure step by step today or tomorrow.

thank you all again, without your time, my time will be useles in this adventure.

[titiris]

here's the guide to follow my steps to unbrick a DSOX2K after flash corruption.

I received the scope with a frequent failure, that is:
green lights near the buttons (ref. to serial) light on in sequence, then RUN/STOP and SINGLE light on, and stay. At this point, the scope doesn't respond and stay forever. The failure repeats exactly the same way, same timing, every time you turn it on.

The procedure. (using my old lab PC, running Win7, and a cheap prolific-based USB to serial cable)

open the scope, and connect a 3.3V level serial cable as depicted here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895
(Thanks FrankBuss)
In my unit, the connector is in a different position and rotated 90º. If it happens to you, it's very easy to locate the ground pins with a multimeter then and count, the pins scheme is the same.

You could test the connection with PuTTy @115200,8,N,1, but I recommend to download TeraTerm for later use of YMODEM.
You can locate TeraTerm here:
https://osdn.net/projects/ttssh2/releases/
or just google Tera Term download
Note: I tried first with ExtraPuTTy, but (at least in my computer) it hangs during the binary transfer, after 20 minutes or more! a real pain.
If your connection works, you should get something like:

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
(...)
it continues until giving you a CRC error or something that aborts your booting process (that's the problem, right?)

Turn off the scope and forget it for a while.

Download a firmware v2.35 from here:
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
(thank to Alanme, the "donkey" )
...many posts say that this is the last version that boots from the USB, it's mandatory because your flash is corrupted.

Decompress it with 7-Zip or whatever application that can deal with .cab files
You will need two files from here:
   nk.bin.comp, to get the kernel image and recover the WinCE
   infiniiVisionSetup.cab, to get the oscilloscope application

Download the tools from here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1035636/#msg1035636
(thanks PA0BZ)
or simply use my own set, attached below.
   
Following the instructions from FrankBuss, modified by  me:
use bincompress.exe to get nk.bin from nk.bin.com

X:\yourfolder>bincompress /d nk.bin.comp nk.bin

then use viewbin.exe to get the info from nk.bin that we will use later

X:\yourfolder>viewbin nk.bin

ViewBin... nk.bin
Image Start = 0x80361000, length = 0x013064D4
                Start address = 0x80362000
Checking record #24 for potential TOC (ROMOFFSET = 0xFF010694)
Checking record #39 for potential TOC (ROMOFFSET = 0xFF1126A4)
Checking record #144 for potential TOC (ROMOFFSET = 0x00000000)
NOTICE! Record 144 looked like a TOC except DLL first = 0x4001C001, and DLL last
 = 0x40C4C094
Done.

Using the data we got from viewbin.exe, convert the nk.bin in the nk.nb0 (the binary) with cvrtbin.exe, to be uploaded later

X:\yourfolder>cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x013064D4 nk.bin

This will result in a nk.nb0 in the same folder. Check it and remember the location.

Run TeraTerm with the same serial port parameters, 115200, 8, N, 1
Place something heavy, or your finger, on your keyboard space bar and turn on the scope. This will interrupt the bootloader (das U-boot), showing a prompt:

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
p500>

Now use the loady function, if you're curious, use the U-boot help first:
p500> help loady
loady - load binary file over serial line (ymodem mode)

Usage:
loady [ off ] [ baud ]
    - load binary file over serial line with offset 'off' and baudrate 'baud'


at the prompt, type

p500> loady 0x0361000 115200

Note from FrankBuss: In case you wonder about the 0x80361000 and 0x361000 difference: this is because of physical and virtual memory addresses. Fortunately, the mapping is really easy in this case.
you should get this:

## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CC

the CCCC will continue until you start to send a file, or a timeout happens after a couple of minutes, maybe.

In Tera Term go to File->Transfer->YMODEM->Send... and open the nk.nb0 that you have prepared before
This process is about 45 minutes long, keep in mind that YMODEM is a fast protocol, but the serial connection is 1000 times slower compared with a 100BaseT

The time consumed by the transmission must be enough to prepare the USB.
There are specific tools  mentioned in old posts, to extract the files from infiniiVisionSetup.cab, that I was unable to find (like WinCE CAB Manager 3.0)
Fortunately, in the PA0BZ tools.zip, there is a Python script that to the job, in a tricky way that works for me
the steps are:
   1- Decompress  infiniiVisionSetup.cab into an empty folder, you wil get many files with scrambled names, don't worry.
   2- copy dosetup.py into the same folder
   3- run python dosetup.py or simply double click on dosetup.py if the .p extension is already assigned (in any case, you need Python 2.x.x installed)
Just in case you need it, the instructions are in the readme.txt in the same tools.zip

Now you have the contents of  infiniiVisionSetup.cab exploded in a tree. The next step is to copy this folder and its contents to the USB pendrive, following the structure found here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171
It's simple, just:
   1- copy the contents of the Secure folder in your USB root.
   2- copy the Temp folder in your USB root. (I don't know if it's really necessary, perhaps a guru can tell me "the truth")
   3- make a folder name Startup in your USB root.
   4- create a file inside the folder Startup, named infiniivision.lnk, containing 48#\Secure\infiniiVision\infiniivisionLauncher.exe
   5- create a file in your USB root, named infiniivisionStartupOverride.txt, containing True
   6- copy the complete cab AS-IS (I used 3000XSeries.02.35.2013061800.cab) that you downloaded before in your USB root

the last point is mandatory because once you get your scope resurrected, you must reflash your flash, using the scope utilities, like if you were updating the firmware!
For instructions, go to the Keysight site. You must go anyway later...
(credits for 4 and 5 to plesa, from his several posts about how to start the scope from a USB drive)

Remove safely your USB and plug it into the scope (I used the front panel USB, I don't know if rear USB do the same)

Return to Tera Term, that was transferring the nk.bin...
At the end of the transfer, your screen should show:

CCCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 5 retries
## Total Size      = 0x013064d4 = 19948756 Bytes

...right after the last C, without any CR/LF

Check if the bytes received are the same, in this case 0x013064d4

The last step: Use the go U-boot command to execute the kernel just downloaded
Cross your fingers, pray, say thanks to James Clerk Maxwell, or whatever your belief recommend, and type at the prompt:

p500> go 0x00362000

The terminal should start echoing a long list of messages, starting with...

## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
(...)

396 lines after the "go" command, you should see the last line:

-----> InfiniiVision is running <-----

and your scope is running! 

Before turning off the scope, remember to update to 2.35 from the .cab already copied in your USB drive!

Several guys here recommend updating to the last version (as I did) to avoid another flash corruption.
To get the guide for updating, go by yourself to the Keysight site.

that's all folks

Thanks to:
  FrankBuss for the instructions to convert nk.bin.comp in nk.nb0, and for uploading the serial port picture
  PA0PBZ for uploading the nk tools and recommending to use 2.35
  travisc for cleaning up and sharing the correct structure to get a bootable USB
  plesa for sharing so many examples about the .cab and .lnk, impossible to name them one by one here
  TheSteve, for remembering to put the full .cab in the USB, to update after the resurrection
sorry if I forgot someone between the hundreds of inspiring posts, I come from the era of embedded systems with 2Kbytes of EEPROM and 256bytes of RAM, my memory is not as big as needed to remember you all 

 P.S.: some of the tools and ideas were taken from here  https://forum.xda-developers.com/showthread.php?t=656086
 

[TheSteve]

Thanks for the post, I have only transferred via network.
Something to keep in mind is that recovering as you did generally only works if you had 2.35 to begin with or maybe a version very close to it. It also depends on where in the boot process your original corruption occurred. Often the scope will not fully boot which means you can't reinstall the firmware from the usb drive.

[titiris]

I'm not sure that you need any particular version before the corruption, because this method overwrites the previous software, whatever it is. I must test it in the future (or someone else?)
To be useful, you need at least das U-boot working, of course, otherwise, you have a real brick. JTAG is the only one way to debrick it (or a soldering iron!  )

[TheSteve]

I'm not sure that you need any particular version before the corruption, because this method overwrites the previous software, whatever it is. I must test it in the future (or someone else?)
To be useful, you need at least das U-boot working, of course, otherwise, you have a real brick. JTAG is the only one way to debrick it (or a soldering iron!  )

The problem is that when you execute the uploaded image it will not boot fully if the original image is too corrupted or there is a version mismatch. The image transferred still relies on data from the original image in flash to fully boot and operate.

[Gandalf_Sr]

Wow titiris, only 3 posts and you're giving us such great detail.  Well done sir!

[edyno]

Here are the values of the components on the main board::
(see attached pictures)

The resistors "RED-COLOR" values are clear.
All capatitors "YELLOW-COLOR" I dismount and measure.
The coils "BLUE-COLOR values" are only compared with cataloque.
E1-E4 are ferrite balun 0805 SMD

Others:
K301   AGQ210S4H
U301   AHCT594
U302   AD8034
U303   2AD2-0001
T   1AM   MBT3904   NPN
D   G2Y    (double D)
U300   AQY214
U601   AD706J
CR301   BAV99W

All results are without guarantee.
I wish you good luck

[Blue]

Hi everyone,

I obtained a lan board from Gribo. Thanks! 

Since the information in this thread is quite cluttered, I'll write up what I did (sort of note to myself).

I have a DSO-X-3014A with some preinstalled options like wavegen, edu, etc.

Upgraded to the latest 2.43 firmware (from Keysight website).
Got the patched_nk.bin.comp file with a MD5 of: 1CA34A1B837B075133BE53B379749BBB

with putty telnet to ip port 23

user: infiniivision
pw: skywalker1977

First login attempt always fails. Just type some rubbish

Put in usb stick containing 2 files:

patched_nk.bin.comp
infiniivision.lnk

execute the following commands:

processmgr kill infiniivisionlauncher.exe
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
copy \usb\infiniivision.lnk to \secure\startup
         (note: Only 1 lnk file in this directory)
type \secure\startup\infiniivision.lnk
         (just to check it)
exit
reboot scope.

contents of infiniivision.lnk (one line only)
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC



I tried also with some additional options like -l FRA -l DVMCTR -l SENSOR -l CANFD -l CXPI -l NFC -l NRZ -l USBPD

It resulted in flashing leds and sweat on my forehead... Fortunately I could get into the scope using telnet and removed those additional items.

Questions
- What does that 211 number mean?
- Are there other options I could/should install?
- Hardware self test: I do not hear any relays clicking anymore. Is this normal?

[TK]

contents of infiniivision.lnk (one line only)
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

Questions
- What does that 211 number mean?

211 is the number of characters after #

[Pinkus]

afair there is a maximum number of characters (255?) the scope will recognize. I remember that adding each single license resulted in some missing licenses as the string was too long.
Just use -l ALL -l BW20 -l SCPIPS and you are all set.

[GregerG]

Doesn't -l PLUS work?

[bicycleguy]

I've been using a DSOX2014A I upgraded around version 2.41.  Yesterday upgraded using the Safar method to 2.43 to get the PLUS+ stuff.

Now it seems like I'm missing an info screen that overlaid statistics I regularly used.
This is what it used to look like:


The Statistics button is missing from the bottom right so no overlay.  Is this maybe the problem with to long a script?  I used;
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

[dougberc]

Ok guys, here goes. I've got a brand spankin' new... well, ok no. (but hey, it's new to me!) ...used DSOX4034. It's dying to be upgraded. Current firmware is 07.20.2017102615. I've looked at post #1931 where PhillyFlyers has graciously contributed an nk.bin.comp specifically for this situation (if I'm reading all of this right; there are a LOT of posts and a LOT of details).

Sooo.... from various posts:

0) Install correct Firmware version first (I'm already on the 7.20... as stated above)
1) I've already downloaded the patched 4k_7.20_nk.bin.comp; copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\4k_7.20_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW50 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go

BUT.. I have a few concerns. My \secure\startup contains NOTHING. Even with a "dir /ah". It seemed from the other posts that this part of the hack was a replacement. Is it an addition? If I read this wrong I appologize. Or is there another way to check that I'm missing? Also shouldn't step 6 be done really as 1a or am I confused?

ALSO, I tried just killing the infiniivisionlauncher.exe - screen goes black - and then relaunching with options (to test the command line) but the scope just reboots with from-factory options installed. I'm assuming this is because the hack isn't done yet. But there DID appear to be posts with earlier firmware that COULD be optioned up this way; (but were temporary in nature). is that correct?

Finally if this really dorks something up, what are the odds you can reverse it? I'm capable of surface mount work and have tools like USB-serial, another scope, etc. Just want to know the sweat factor.

Very, very thankful for any help!
-d

[Pinkus]

I can confirm that \secure\startup  is empty on my scope too and afair (I will check my notes tomorrow) only flashing of the new .bin file is needed, nothing else.  Thus step 6 and 7 will not be needed. Maybe somebody has his note ready and can confirm/correct me.

[bicycleguy]

afair there is a maximum number of characters (255?) the scope will recognize. I remember that adding each single license resulted in some missing licenses as the string was too long.
Just use -l ALL -l BW20 -l SCPIPS and you are all set.

Think your missing a few.  After a bit of fun this seems optimum on a DSOX2014A with firmware 2.43:
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID

Some reasoning:
DIS adds a bunch of options like ALL without adding a * to each feature in the about screen
MSO does its name
--perf is req'd to get the Meas/Statistics button and screen shown at https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070
CABLE is req'd for Analyze/'Ratio and Phase Ref' menu
VID is req'd for extra video triggers and features

Any missed?

[bicycleguy]

Doesn't -l PLUS work?

That only gets you: MEMUP,SGM,EDK,DVM,RML,PLUS

USE

...  After a bit of fun this seems optimum on a DSOX2014A with firmware 2.43:
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID

Some reasoning:
DIS adds a bunch of options like ALL without adding a * to each feature in the about screen
MSO does its name
--perf is req'd to get the Meas/Statistics button and screen shown at https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070
CABLE is req'd for Analyze/'Ratio and Phase Ref' menu
VID is req'd for extra video triggers and features

Any missed?

to get this: